Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm attempting to set up SSH on a Cisco 2811 and having some difficulties.

The first step to this should be running crypto key generate rsa

I seem to be missing this though:

better#crypto key generate rsa
% Invalid input detected at '^' marker.


Furthermore, the only available commands I have in the crypto key namespace are lock and unlock, which seem to indicate a locked keypair (for which I don't know the password):

better#crypto key ?
lock    Lock a keypair.
unlock  Unlock a keypair.

better#crypto key unlock ?
rsa  RSA keys

better#crypto key unlock rsa
%% Please enter the passphrase: 
%% Unlocking failed.


More or less, I'm asking what exactly this might mean, and if I actually do have certificates already here (used router)? Otherwise, how can I solve this? It's my first time configuring this feature, but I definitely believe it's part of my IOS.

Speaking of my IOS, I'm running the image c2800nm-advsecurityk9-mz.124-24.T6.bin

I'll also note that I have my hostname and ip domain-name configured. I'll also give you a dir flash: below if it's at all of use:

better#dir flash:
Directory of flash:/

    2  -rw-        2748  Jul 27 2009 14:03:52 +00:00  sdmconfig-2811.cfg
    3  -rw-      931840  Jul 27 2009 14:04:10 +00:00  es.tar
    4  -rw-     1505280  Jul 27 2009 14:04:32 +00:00  common.tar
    5  -rw-        1038  Jul 27 2009 14:04:46 +00:00  home.shtml
    6  -rw-      112640  Jul 27 2009 14:05:00 +00:00  home.tar
    7  -rw-     1697952  Jul 27 2009 14:05:26 +00:00  securedesktop-ios-
    8  -rw-      415956  Jul 27 2009 14:05:46 +00:00  sslclient-win-
    9  -rw-    38732900   Dec 8 2011 06:28:56 +00:00  c2800nm-advsecurityk9-mz.124-24.T6.bin

64016384 bytes total (20598784 bytes free)
share|improve this question

migrated from Apr 3 '12 at 12:08

This question came from our site for professional and enthusiast programmers.

Resolution: Switch to global config mode. =( Stackoverflow won't let me resolve it just yet because the question is new. – Matt Malesky Apr 3 '12 at 6:21
up vote 1 down vote accepted

Silly me, being in the wrong mode:

better(config)#crypto key generate rsa
The name for the keys will be:
Choose the size of the key modulus in the range of 360 to 2048 for your
  General Purpose Keys. Choosing a key modulus greater than 512 may take
  a few minutes.

How many bits in the modulus [512]: 
% Generating 512 bit RSA keys, keys will be non-exportable...[OK]

share|improve this answer
For ssh you will need keys of 768 bits in length probably, not 512. Also give the device a domain name and make sure its set to SSH version 2, with login period and failed auth count etc. – jwbensley Apr 17 '12 at 21:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.